Hey everyone!

I need to build my tool box and need some advise on current software. Working only on PC and laptops, no networks,  Any assistance will help. Thank you in advance!

I have tried a few data recovery software but, they have been limited on their recovery. Need Instant Message history, email, url, picture, video, etc... The information I am able to recover may be used in court. Hope this helps......thanks again......

there are several on the market that you can purchase that will work well.

1. Disk Doctors Instant File Recovery- Disk Doctors Instant File Recovery recovers deleted files emptied from Recycle Bin or lost while accidental formatting or re-partitioning of a hard drive or lost due to virus attacks and unexpected system or software malfunction. It's about $60.00


2. Easy Drive Data Recovery- can be used to recover data from corrupted or accidentally formatted disks. The program uses powerful unique algorithms that even allow the recovery of files that are not present in file system entries. Just select a disk with data to be analyzed, preview file content and select the file(s) to be recovered. It does not matter in what circumstances data has been lost—the program will recover as many files as possible. Again, about $60.00 bucks

3. LeKuSoft Data Recovery- is an advanced recovery solution that will easily recover lost or deleted files from the recycle bin, partition losses, or mistaken deletion. It can effectively recover lost data in hard drives, flash drives and memory cards (such as SD cards, MMC cards), etc., and quickly help you solve the trouble caused by the loss of data, files or pictures. About $65.00

hope this helps........let me know if you have any further questions....

Thanks for your advise Andy and seawolve.....gonna try andys suggestion....I'll keep ya posted!

Helix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there.  I'd also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform.  Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well.  I currently use all 4 plus a random assortment of scripts and tools I've picked up along the way.  Sans ftk is free after registering here:  http://computer-forensics.sans.org/

Alternatives / additions
Autopsy, Sleuth kit, foremost / scalpel, dd, Sys internals suite, volatility memory framework, hex editor, Caine live cd, prodiscover basic, a sandbox, regedit, strings, physical write blocker, l0phtcrack, PRTK, TCT


You should be careful with this though, if you've handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.

Also to add onto what R3 said.  If you come across a Hard Drive that has CP and don't immediatly give it to the LEO then you can be charged with possesion and distribution. 

Tred carefully.

tools I use on a daily basis are -

FTK Imager
Helix


encase
netanalysis
IEF
Media Detective
WinHex
Windows File Analyzer
VFC (virtual forensic computing)
Live View
Mount image pro
VMWare Workstation

plus AV software to scan the systems for virus's which I always report on.

Alot of the software above will cost a bit.  If using in court then you really need to know what your doing, are you based in the US? UK? or OTHER?